tinyauth: init at 5.0.1
This commit is contained in:
Shaun Ren
@@ -58,6 +58,8 @@
|
||||
|
||||
- [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
|
||||
|
||||
- [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
|
||||
|
||||
- [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
|
||||
|
||||
- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
|
||||
|
||||
@@ -1525,6 +1525,7 @@
|
||||
./services/security/step-ca.nix
|
||||
./services/security/tang.nix
|
||||
./services/security/timekpr.nix
|
||||
./services/security/tinyauth.nix
|
||||
./services/security/tor.nix
|
||||
./services/security/torify.nix
|
||||
./services/security/torsocks.nix
|
||||
|
||||
@@ -0,0 +1,246 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
getExe
|
||||
maintainers
|
||||
mapAttrs'
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
mkPackageOption
|
||||
nameValuePair
|
||||
optionalAttrs
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.services.tinyauth;
|
||||
|
||||
format = pkgs.formats.keyValue { };
|
||||
settingsFile = format.generate "tinyauth-env-vars" (
|
||||
mapAttrs' (name: value: nameValuePair "TINYAUTH_${name}" value) cfg.settings
|
||||
);
|
||||
in
|
||||
{
|
||||
options.services.tinyauth = {
|
||||
enable = mkEnableOption "Tinyauth server";
|
||||
|
||||
package = mkPackageOption pkgs "tinyauth" { };
|
||||
|
||||
environmentFile = mkOption {
|
||||
type = types.path;
|
||||
description = ''
|
||||
Path to an environment file loaded for Tinyauth.
|
||||
|
||||
This can be used to securely store tokens and secrets outside of the world-readable Nix store.
|
||||
|
||||
Example contents of the file:
|
||||
```
|
||||
TINYAUTH_AUTH_USERS=user-hash
|
||||
TINYAUTH_OAUTH_PROVIDERS_GOOGLE_CLIENTSECRET=client-secret
|
||||
```
|
||||
'';
|
||||
default = "/dev/null";
|
||||
example = "/var/lib/secrets/tinyauth";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = format.type;
|
||||
|
||||
options = {
|
||||
SERVER_ADDRESS = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Address to bind the server to.
|
||||
'';
|
||||
default = "0.0.0.0";
|
||||
};
|
||||
|
||||
SERVER_PORT = mkOption {
|
||||
type = types.port;
|
||||
description = ''
|
||||
The port to run the server on.
|
||||
'';
|
||||
default = 3000;
|
||||
};
|
||||
|
||||
APPURL = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
URL of the app.
|
||||
'';
|
||||
example = "https://auth.example.com";
|
||||
};
|
||||
|
||||
ANALYTICS_ENABLED = mkOption {
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to enable anonymous version collection.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
RESOURCES_ENABLED = mkOption {
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to enable the resources server.
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
|
||||
AUTH_LOGINMAXRETRIES = mkOption {
|
||||
type = types.ints.unsigned;
|
||||
description = ''
|
||||
Maximum login attempts before timeout (0 to disable).
|
||||
'';
|
||||
default = 3;
|
||||
};
|
||||
|
||||
AUTH_LOGINTIMEOUT = mkOption {
|
||||
type = types.ints.unsigned;
|
||||
description = ''
|
||||
Login timeout in seconds after max retries reached (0 to disable).
|
||||
'';
|
||||
default = 300;
|
||||
};
|
||||
|
||||
AUTH_TRUSTEDPROXIES = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Comma-separated list of trusted proxy addresses.
|
||||
'';
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
default = { };
|
||||
|
||||
description = ''
|
||||
Environment variables that will be passed to Tinyauth.
|
||||
The "TINYAUTH_" prefix will be prepended to the setting names.
|
||||
See [configuration options](https://tinyauth.app/docs/reference/configuration)
|
||||
for supported values.
|
||||
'';
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.path;
|
||||
default = "/var/lib/tinyauth";
|
||||
description = ''
|
||||
The directory where Tinyauth will store its data.
|
||||
'';
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "tinyauth";
|
||||
description = "User account under which Tinyauth runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "tinyauth";
|
||||
description = "Group account under which Tinyauth runs.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.tmpfiles.settings.tinyauth = {
|
||||
"${cfg.dataDir}".d = {
|
||||
mode = "0750";
|
||||
user = cfg.user;
|
||||
group = cfg.group;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.tinyauth = {
|
||||
description = "Tinyauth";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
restartTriggers = [
|
||||
cfg.package
|
||||
cfg.environmentFile
|
||||
settingsFile
|
||||
];
|
||||
|
||||
environment = {
|
||||
GIN_MODE = "release";
|
||||
TINYAUTH_DATABASE_PATH = "${cfg.dataDir}/tinyauth.db";
|
||||
TINYAUTH_RESOURCES_PATH = "${cfg.dataDir}/resources";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
ExecStart = getExe cfg.package;
|
||||
Restart = "always";
|
||||
|
||||
EnvironmentFile = [
|
||||
cfg.environmentFile
|
||||
settingsFile
|
||||
];
|
||||
|
||||
# Hardening
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = "disconnected";
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_UNIX"
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
|
||||
users.users = optionalAttrs (cfg.user == "tinyauth") {
|
||||
tinyauth = {
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
description = "Tinyauth user";
|
||||
home = cfg.dataDir;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = optionalAttrs (cfg.group == "tinyauth") {
|
||||
tinyauth = { };
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [ shaunren ];
|
||||
}
|
||||
@@ -1643,6 +1643,7 @@ in
|
||||
timezone = runTest ./timezone.nix;
|
||||
timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
|
||||
tinc = handleTest ./tinc { };
|
||||
tinyauth = runTest ./tinyauth.nix;
|
||||
tinydns = runTest ./tinydns.nix;
|
||||
tinyproxy = runTest ./tinyproxy.nix;
|
||||
tinywl = runTest ./tinywl.nix;
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
port = 3001;
|
||||
in
|
||||
{
|
||||
name = "tinyauth";
|
||||
meta.maintainers = with lib.maintainers; [ shaunren ];
|
||||
|
||||
nodes.machine = {
|
||||
services.tinyauth = {
|
||||
enable = true;
|
||||
settings = {
|
||||
APPURL = "http://auth.example.com";
|
||||
SERVER_PORT = port;
|
||||
ANALYTICS_ENABLED = false;
|
||||
};
|
||||
|
||||
environmentFile = pkgs.writeText "tinyauth-env" ''
|
||||
TINYAUTH_AUTH_USERS=test:$$2a$$10$$NP5wKRFw5GuVVI.g07zvAucRYk0cyL83WDPVQ81Zai.Xi5tkNvxL6
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
machine.wait_for_unit("tinyauth.service")
|
||||
machine.wait_for_open_port(${toString port})
|
||||
|
||||
machine.succeed("curl -sSf -H Host:auth.example.com http://localhost:${toString port}")
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
{
|
||||
lib,
|
||||
buildGoModule,
|
||||
fetchFromGitHub,
|
||||
git,
|
||||
stdenvNoCC,
|
||||
bun,
|
||||
nixosTests,
|
||||
nix-update-script,
|
||||
}:
|
||||
|
||||
buildGoModule (finalAttrs: {
|
||||
pname = "tinyauth";
|
||||
version = "5.0.1";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "steveiliop56";
|
||||
repo = "tinyauth";
|
||||
tag = "v${finalAttrs.version}";
|
||||
fetchSubmodules = true;
|
||||
hash = "sha256-ypM56yrUWF1OzCj5RBGyEhZzjyDcko7SPQ+eVhHEzmA=";
|
||||
};
|
||||
|
||||
vendorHash = "sha256-qELLarAR78WkDoJKtqaqzIZaTBCuHP41JCyjLZ4aMtM=";
|
||||
|
||||
subPackages = [ "cmd/tinyauth" ];
|
||||
|
||||
env.CGO_ENABLED = 0;
|
||||
ldflags = [
|
||||
"-s"
|
||||
"-w"
|
||||
"-X tinyauth/internal/config.Version=v${finalAttrs.version}"
|
||||
"-X tinyauth/internal/config.CommitHash=${finalAttrs.src.rev}"
|
||||
];
|
||||
|
||||
preBuild = ''
|
||||
cp -r ${finalAttrs.frontend}/dist internal/assets/dist
|
||||
'';
|
||||
|
||||
postPatch = ''
|
||||
${lib.getExe git} apply --directory paerser/ patches/nested_maps.diff
|
||||
'';
|
||||
|
||||
frontend = stdenvNoCC.mkDerivation {
|
||||
pname = "tinyauth-frontend";
|
||||
inherit (finalAttrs) version src;
|
||||
sourceRoot = "${finalAttrs.src.name}/frontend";
|
||||
|
||||
impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
|
||||
"GIT_PROXY_COMMAND"
|
||||
"SOCKS_SERVER"
|
||||
];
|
||||
|
||||
nativeBuildInputs = [
|
||||
bun
|
||||
];
|
||||
|
||||
configurePhase = ''
|
||||
runHook preConfigure
|
||||
|
||||
bun install --no-progress --frozen-lockfile
|
||||
substituteInPlace node_modules/.bin/{tsc,vite} \
|
||||
--replace-fail "/usr/bin/env node" "${lib.getExe bun}"
|
||||
|
||||
runHook postConfigure
|
||||
'';
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
|
||||
bun run build
|
||||
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/dist
|
||||
cp -r dist $out
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
outputHashMode = "recursive";
|
||||
outputHash = "sha256-pB94TUwjm5GmEmgjqkr7QH9BoRhKCSbxQVOc+2fCz2c=";
|
||||
};
|
||||
|
||||
passthru = {
|
||||
tests = {
|
||||
inherit (nixosTests) tinyauth;
|
||||
};
|
||||
updateScript = nix-update-script {
|
||||
extraArgs = [
|
||||
"--subpackage"
|
||||
"frontend"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
meta = {
|
||||
description = "Simple authentication middleware for web apps";
|
||||
homepage = "https://tinyauth.app";
|
||||
changelog = "https://github.com/steveiliop56/tinyauth/releases/tag/v${finalAttrs.version}";
|
||||
license = lib.licenses.gpl3Only;
|
||||
mainProgram = "tinyauth";
|
||||
maintainers = with lib.maintainers; [
|
||||
shaunren
|
||||
];
|
||||
platforms = lib.platforms.unix;
|
||||
};
|
||||
})
|
||||
Reference in New Issue
Block a user